supabase

Records5All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

supabase records in CISA KEV

No supabase vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records

TI-2024-16040 CVE-2024-24213 · GHSA-vq84-wx4w-6r76

MEDIUM 51

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01069 Published 2024-02-08 No fix listed CWE-89

TI-2026-44468 CVE-2026-62247

LOW 29

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00451 Published 2026-09-21 Fixed in 2.111.2 CWE-863

TI-2026-24366 CVE-2026-31813

LOW 21

Supabase Auth is a JWT based API for managing users and issuing JWT tokens.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.0016 Published 2026-03-11 Fixed in 2.185.0 CWE-290

TI-2025-30696 CVE-2025-48370 · GHSA-8r88-6cj9-9fh5

LOW 21

auth-js is an isomorphic Javascript library for Supabase Auth.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00902 Published 2025-05-27 Fixed in 2.70.0 CWE-22

TI-2026-79331 CVE-2026-54238

LOW 15

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00206 Published 2026-10-22 Fixed in 2.103.1 CWE-613